Hacker News Reader

And perhaps even more critically: by which vendors? Who consistently misses the deadline?

Judging by https://bugs.chromium.org/p/project-zero/issues/list?can=1&q..., it looks like Apple, Adobe and Microsoft are the main vendors who miss deadlines, although I don't know how many other vendors Project Zero focuses on in total.

That doesn't terribly surprise me. More/larger products, more opportunity to miss bugs or not be agile enough to work on them.